# External Module Import
from zlib import decompress
from traceback import format_exc

# Internal Module Import
from VScan.parse.Common import CFile, CBuffer

def fnExploitHWP(Section):
	try :
		sDecrypt = decompress(Section, -15)
	except :
		sDecrypt = Section
	
	nPos = 0
	while nPos < len(sDecrypt) :
		nRecord = CBuffer.fnReadData(sDecrypt, nPos, 4)
		if nRecord == None :
			print "[Failure] fnReadData(nPos : 0x%08X, Size : 4Bytes)" % nPos
			return False
			
		nPos += 4
		nTagID = nRecord & 0b1111111111
		nSize = (nRecord >> 20) & 0b111111111111
		if nSize == 0xfff :
			nSize = CBuffer.fnReadData(sDecrypt, nPos, 4)
			nPos += 4
		nPos += nSize
		
	if nPos != len(sDecrypt) :
		print "[FOUND] Vulnerability : 0x%02X [ %s ]" % (nTagID, HWPTAG[nTagID])
		return "Infect"
		
	return True
	
# TagID
HWPTAG_BEGIN = 0x010
# HWPINFO
HWPTAG = {HWPTAG_BEGIN      :"HWPTAG_DOCUMENT_PROPERTIES",
          HWPTAG_BEGIN+1    :"HWPTAG_ID_MAPPINGS",
          HWPTAG_BEGIN+2    :"HWPTAG_BIN_DATA",
          HWPTAG_BEGIN+3    :"HWPTAG_FACE_NAME",
          HWPTAG_BEGIN+4    :"HWPTAG_BORDER_FILL",
          HWPTAG_BEGIN+5    :"HWPTAG_CHAR_SHAPE",
          HWPTAG_BEGIN+6    :"HWPTAG_TAB_DEF",
          HWPTAG_BEGIN+7    :"HWPTAG_NUMBERING",
          HWPTAG_BEGIN+8    :"HWPTAG_BULLET",
          HWPTAG_BEGIN+9    :"HWPTAG_PARA_SHAPE",
          HWPTAG_BEGIN+10   :"HWPTAG_STYLE",
          HWPTAG_BEGIN+11   :"HWPTAG_DOC_DATA",
          HWPTAG_BEGIN+12   :"HWPTAG_DISTRIBUTE_DOC_DATA",
          HWPTAG_BEGIN+13   :"RESERVED",
          HWPTAG_BEGIN+14   :"HWPTAG_COMPATIBLE_DOCUMENT",
          HWPTAG_BEGIN+15   :"HWPTAG_LAYOUT_COMPATIBILITY",
          
          # BodyText 
          HWPTAG_BEGIN+50   :"HWPTAG_PARA_HEADER",
          HWPTAG_BEGIN+51   :"HWPTAG_PARA_TEXT",
          HWPTAG_BEGIN+52   :"HWPTAG_PARA_CHAR",
          HWPTAG_BEGIN+53   :"HWPTAG_PARA_LINE_SEG",
          HWPTAG_BEGIN+54   :"HWPTAG_PARA_RANGE_TAG",
          HWPTAG_BEGIN+55   :"HWPTAG_CTRL_HEADER",
          HWPTAG_BEGIN+56   :"HWPTAG_LIST_HEADER",
          HWPTAG_BEGIN+57   :"HWPTAG_PAGE_DEF",
          HWPTAG_BEGIN+58   :"HWPTAG_FOOTNOTE_SHAPE",
          HWPTAG_BEGIN+59   :"HWPTAG_PAGE_BORDER_FILL",
          HWPTAG_BEGIN+60   :"HWPTAG_SHAPE_COMPONENT",
          HWPTAG_BEGIN+61   :"HWPTAG_TABLE",
          HWPTAG_BEGIN+62   :"HWPTAG_SHAPE_COMPONENT_LINE",
          HWPTAG_BEGIN+63   :"HWPTAG_SHAPE_COMPONENT_RECTANGLE",
          HWPTAG_BEGIN+64   :"HWPTAG_SHAPE_COMPONENT_ELLIPSE",
          HWPTAG_BEGIN+65   :"HWPTAG_SHAPE_COMPONENT_ARC",
          HWPTAG_BEGIN+66   :"HWPTAG_SHAPE_COMPONENT_POLYGON",
          HWPTAG_BEGIN+67   :"HWPTAG_SHAPE_COMPONENT_CURVE",
          HWPTAG_BEGIN+68   :"HWPTAG_SHAPE_COMPONENT_OLE",
          HWPTAG_BEGIN+69   :"HWPTAG_SHAPE_COMPONENT_PICTURE",
          HWPTAG_BEGIN+70   :"HWPTAG_SHAPE_COMPONENT_CONTAINER",
          HWPTAG_BEGIN+71   :"HWPTAG_CTRL_DATA",
          HWPTAG_BEGIN+72   :"HWPTAG_EQEDIT",
          HWPTAG_BEGIN+73   :"RESERVED",
          HWPTAG_BEGIN+74   :"HWPTAG_SHAPE_COMPONENT_TEXTART",
          HWPTAG_BEGIN+75   :"HWPTAG_FORM_OBJECT",
          HWPTAG_BEGIN+76   :"HWPTAG_SHAPE",
          HWPTAG_BEGIN+77   :"HWPTAG_MEMO_LIST",
          
          # DocInfo          
          HWPTAG_BEGIN+78   :"HWPTAG_FORBIDDEN_CHAR",
          
          # BodyText
          HWPTAG_BEGIN+79   :"HWPTAG_CHART_DATA",
          HWPTAG_BEGIN+99   :"HWPTAG_SHAPE_COMPONENT_UNKNOWN" }
	